CVE-2025-40248: vsock: Ignore signal/timeout on connect() if already established

Published Dec 4, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

vsock: Ignore signal/timeout on connect() if already established

During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues:

1. connect() invoking vsocktransportcancelpkt() - virtiotransportpurgeskbs() may race with sendmsg() invoking virtiotransportgetcredit(). This results in a permanently elevated vvs-bytesunsent. Which, in turn, confuses the SOCKLINGER handling.

2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs.

3. connect() transitioning SSCONNECTED - SSUNCONNECTED allows for a transport change/drop after TCPESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref.

Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg().

[1]:

Other sources

In the Linux kernel, the following vulnerability has been resolved:

vsock: Ignore signal/timeout on connect() if already established

During connect(), acting on a signal/timeout by disconnecting an already established socket leads to several issues:

1. connect() invoking vsocktransportcancelpkt() -> virtiotransportpurgeskbs() may race with sendmsg() invoking virtiotransportgetcredit(). This results in a permanently elevated vvs->bytesunsent. Which, in turn, confuses the SOCKLINGER handling.

2. connect() resetting a connected socket's state may race with socket being placed in a sockmap. A disconnected socket remaining in a sockmap breaks sockmap's assumptions. And gives rise to WARNs.

3. connect() transitioning SSCONNECTED -> SSUNCONNECTED allows for a transport change/drop after TCPESTABLISHED. Which poses a problem for any simultaneous sendmsg() or connect() and may result in a use-after-free/null-ptr-deref.

Do not disconnect socket on signal/timeout. Keep the logic for unconnected sockets: they don't linger, can't be placed in a sockmap, are rejected by sendmsg().

[1]: https://lore.kernel.org/netdev/e07fd95c-9a38-4eea-9638-133e38c2ec9b@rbox.co/ [2]: https://lore.kernel.org/netdev/20250317-vsock-trans-signal-race-v4-0-fc8837f3f1d4@rbox.co/ [3]: https://lore.kernel.org/netdev/60f1b7db-3099-4f6a-875e-af9f6ef194f6@rbox.co/

Red Hat

Affected Software

8 affected componentsFixes available
Linux Kernel
Microsoft azl3 kernel 6.6.112.1-2
Microsoft azl3 kernel 6.6.117.1-1
Microsoft azl3 kernel 6.6.117.1-1
IBM Verify Identity Access<=11.0 - 11.0.2
IBM Security Verify Access<=10.0 - 10.0.9.1
IBM Verify Identity Access Container<=11.0 - 11.0.2
IBM Security Verify Access Container<=10.0 - 10.0.9.1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Configuration

    For vsock, ignore signal/timeout handling during connect() when the socket is already established (already in SS_CONNECTED) to avoid races caused by disconnecting/unwinding the socket state on signal/timeout.

    Linux kernel vsock Ignore signal/timeout on connect() if already established = enabled

Event History

Dec 4, 2025
CVE Published
via MITRE·04:08 PM
Data Sourced
via MITRE·04:08 PM
Description
Data Sourced
via NVD·04:16 PM
Description
Data Sourced
via Red Hat·05:02 PM
DescriptionSeverityAffected Software
Dec 6, 2025
Data Sourced
via Microsoft·01:02 AM
DescriptionSeverityWeaknessAffected Software
Updated
via Microsoft·01:02 AM
Affected Software
Updated
via Microsoft·01:02 AM
DescriptionSeverity
Jul 8, 2026
Data Sourced
via IBM·12:00 AM
DescriptionAffected Software

Parent advisories

This vulnerability appears in the following advisories.

Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Frequently Asked Questions

1

What is the severity of CVE-2025-40248?

CVE-2025-40248 has a medium severity rating due to the potential impact on established socket connections.

2

How do I fix CVE-2025-40248?

To fix CVE-2025-40248, ensure you update your Linux kernel to the latest stable version where this vulnerability has been patched.

3

What systems are affected by CVE-2025-40248?

CVE-2025-40248 affects various versions of the Linux kernel utilizing the vsock protocol.

4

What are the consequences of CVE-2025-40248?

The consequences of CVE-2025-40248 include possible disconnections of established sockets upon receiving signals or timeouts during connect().

5

How does CVE-2025-40248 impact network communication?

CVE-2025-40248 can disrupt network communication by improperly handling socket connections, leading to instability.

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203